superencryptx 0.1.2

Scan a repo for secrets and encrypt/decrypt them in-place.

superencrypt

https://pypi.org/project/superencryptx/

CLI to scan a repo for secrets (including env files, Dockerfiles, compose files, and YAML/TOML/JSON/INI-style configs), encrypt them in-place, and decrypt them later using a key.

Why

superencrypt helps you keep accidental secrets out of your repo history by encrypting sensitive values in-place while keeping files versionable.

Install

pip install superencryptx

uv (recommended)

uv tool install superencryptx

No venv (recommended)

pipx install superencryptx

System install (no venv)

python3 -m pip install --user superencryptx

Quick start

# Encrypt in-place (generates a key, prints it, and writes .superencrypt.key)
superencrypt encrypt

# Decrypt in-place (use in CI/CD pipelines)
superencrypt decrypt --key-file .superencrypt.key

Usage

# Show help
superencrypt --help

# Encrypt in-place (generates a key, prints it, and writes .superencrypt.key)
superencrypt encrypt

# Decrypt in-place (provide key or key file)
superencrypt decrypt --key-file .superencrypt.key

# Scan only (no changes)
superencrypt scan

# Scan output formats
superencrypt scan --table
superencrypt scan --json

# Scan a single file
superencrypt scan --file path/to/file

# Encrypt/decrypt a single file
superencrypt encrypt --file path/to/file
superencrypt decrypt --file path/to/file --key-file .superencrypt.key

Pipeline example

export SUPERENCRYPT_KEY="$(cat .superencrypt.key)"
superencrypt decrypt --key "$SUPERENCRYPT_KEY"

Key file usage

# Generate a key and write .superencrypt.key
superencrypt encrypt

# Use the key file to decrypt
superencrypt decrypt --key-file .superencrypt.key

# Load key into env and decrypt (CI/CD friendly)
export SUPERENCRYPT_KEY="$(cat .superencrypt.key)"
superencrypt decrypt --key "$SUPERENCRYPT_KEY"

Limitations

• superencrypt uses pattern and heuristic matching. It focuses on raw literal values and may miss secrets that are:
  • Generated or templated at runtime.
  • Pulled from variables, references, or function calls.
  • Hidden inside custom formats or encrypted blobs.
• Always use defense-in-depth (secret managers, least privilege, CI checks).

Recognized Tokens

• AWS access keys and session tokens
• GitHub tokens (ghp_, gho_, ghs_, ghu_, github_pat_)
• Slack tokens (xoxb-, xoxp-, xoxa-, xoxr-, xoxs-)
• Azure storage connection strings and SAS tokens
• GCP API keys (AIza...) and OAuth tokens (ya29...)
• JWTs
• Database connection strings with embedded credentials
• PEM private key headers (BEGIN ... PRIVATE KEY)

Notes

• Encrypted values are stored as ENC[<token>].
• Key file .superencrypt.key should be protected and not committed.
• Use scan first to review matches.

Development

https://pypi.org/project/superencryptx/

python -m venv .venv
source .venv/bin/activate
pip install -e .